@attest-it/core 0.4.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.d.cts CHANGED
@@ -1390,6 +1390,18 @@ declare class OnePasswordKeyProvider implements KeyProvider {
1390
1390
  interface MacOSKeychainKeyProviderOptions {
1391
1391
  /** Item name in keychain (e.g., "attest-it-private-key") */
1392
1392
  itemName: string;
1393
+ /** Path to the keychain file (optional, uses default keychain if not specified) */
1394
+ keychain?: string;
1395
+ }
1396
+ /**
1397
+ * Information about a macOS keychain.
1398
+ * @public
1399
+ */
1400
+ interface MacOSKeychain {
1401
+ /** Full path to the keychain file */
1402
+ path: string;
1403
+ /** Display name (filename without extension) */
1404
+ name: string;
1393
1405
  }
1394
1406
  /**
1395
1407
  * Key provider that stores private keys in macOS Keychain.
@@ -1405,6 +1417,7 @@ declare class MacOSKeychainKeyProvider implements KeyProvider {
1405
1417
  readonly type = "macos-keychain";
1406
1418
  readonly displayName = "macOS Keychain";
1407
1419
  private readonly itemName;
1420
+ private readonly keychain?;
1408
1421
  private static readonly ACCOUNT;
1409
1422
  /**
1410
1423
  * Create a new MacOSKeychainKeyProvider.
@@ -1416,6 +1429,11 @@ declare class MacOSKeychainKeyProvider implements KeyProvider {
1416
1429
  * Only available on macOS platforms.
1417
1430
  */
1418
1431
  static isAvailable(): boolean;
1432
+ /**
1433
+ * List available keychains on the system.
1434
+ * @returns Array of keychain information
1435
+ */
1436
+ static listKeychains(): Promise<MacOSKeychain[]>;
1419
1437
  /**
1420
1438
  * Check if this provider is available on the current system.
1421
1439
  */
@@ -1506,6 +1524,7 @@ type PrivateKeyRef = {
1506
1524
  type: 'keychain';
1507
1525
  service: string;
1508
1526
  account: string;
1527
+ keychain?: string;
1509
1528
  } | {
1510
1529
  type: '1password';
1511
1530
  account?: string;
@@ -1545,6 +1564,21 @@ interface LocalConfig {
1545
1564
  * @packageDocumentation
1546
1565
  */
1547
1566
 
1567
+ /**
1568
+ * Set a custom home directory for attest-it configuration.
1569
+ * This is useful for testing or running with isolated state.
1570
+ *
1571
+ * @param dir - The directory to use, or null to reset to default
1572
+ * @public
1573
+ */
1574
+ declare function setAttestItHomeDir(dir: string | null): void;
1575
+ /**
1576
+ * Get the current attest-it home directory override.
1577
+ *
1578
+ * @returns The override directory, or null if using default
1579
+ * @public
1580
+ */
1581
+ declare function getAttestItHomeDir(): string | null;
1548
1582
  /**
1549
1583
  * Error thrown when local config validation fails.
1550
1584
  * @public
@@ -1556,10 +1590,23 @@ declare class LocalConfigValidationError extends Error {
1556
1590
  /**
1557
1591
  * Get the path to the local config file.
1558
1592
  *
1559
- * @returns Path to ~/.config/attest-it/config.yaml
1593
+ * If a home directory override is set via setAttestItHomeDir(),
1594
+ * returns {homeDir}/config.yaml. Otherwise returns ~/.config/attest-it/config.yaml.
1595
+ *
1596
+ * @returns Path to the local config file
1560
1597
  * @public
1561
1598
  */
1562
1599
  declare function getLocalConfigPath(): string;
1600
+ /**
1601
+ * Get the attest-it configuration directory.
1602
+ *
1603
+ * If a home directory override is set via setAttestItHomeDir(),
1604
+ * returns that directory. Otherwise returns ~/.config/attest-it.
1605
+ *
1606
+ * @returns Path to the configuration directory
1607
+ * @public
1608
+ */
1609
+ declare function getAttestItConfigDir(): string;
1563
1610
  /**
1564
1611
  * Load and validate local config from file (async).
1565
1612
  *
@@ -1832,4 +1879,4 @@ declare function verifyAllSeals(config: AttestItConfig, seals: SealsFile, finger
1832
1879
  */
1833
1880
  declare const version = "0.0.0";
1834
1881
 
1835
- export { type AttestItConfig, type AttestItSettings, type Attestation, type AttestationsFile, type Config, ConfigNotFoundError, ConfigValidationError, type CreateSealOptions, type VerifyOptions$1 as CryptoVerifyOptions, type KeyPair as Ed25519KeyPair, FilesystemKeyProvider, type FilesystemKeyProviderOptions, type FingerprintConfig, type FingerprintOptions, type FingerprintResult, type GateConfig, type Identity, type KeyGenerationResult, type KeyPaths, type KeyProvider, type KeyProviderConfig, type KeyProviderFactory, KeyProviderRegistry, type KeyProviderSettings, type KeyRetrievalResult, type KeygenOptions, type KeygenProviderOptions, type LocalConfig, LocalConfigValidationError, MacOSKeychainKeyProvider, type MacOSKeychainKeyProviderOptions, type OnePasswordAccount, OnePasswordKeyProvider, type OnePasswordKeyProviderOptions, type OnePasswordVault, type PrivateKeyRef, type ReadSignedAttestationsOptions, type Seal, type SealVerificationResult, type SealsFile, type SignOptions, SignatureInvalidError, type SignatureVerificationResult, type SuiteConfig, type SuiteVerificationResult, type TeamMember, type VerificationState, type VerificationStatus, type VerifyOptions, type VerifyResult, type WriteSignedAttestationsOptions, canonicalizeAttestations, checkOpenSSL, computeFingerprint, computeFingerprintSync, createAttestation, createSeal, findAttestation, findConfigPath, findTeamMemberByPublicKey, generateKeyPair as generateEd25519KeyPair, generateKeyPair$1 as generateKeyPair, getActiveIdentity, getAuthorizedSignersForGate, getDefaultPrivateKeyPath, getDefaultPublicKeyPath, getGate, getLocalConfigPath, getPublicKeyFromPrivate, isAuthorizedSigner, listPackageFiles, loadConfig, loadConfigSync, loadLocalConfig, loadLocalConfigSync, parseDuration, readAndVerifyAttestations, readAttestations, readAttestationsSync, readSeals, readSealsSync, removeAttestation, resolveConfigPaths, saveLocalConfig, saveLocalConfigSync, setKeyPermissions, sign$1 as sign, sign as signEd25519, toAttestItConfig, upsertAttestation, verify$1 as verify, verifyAllSeals, verifyAttestations, verify as verifyEd25519, verifyGateSeal, verifySeal, version, writeAttestations, writeAttestationsSync, writeSeals, writeSealsSync, writeSignedAttestations };
1882
+ export { type AttestItConfig, type AttestItSettings, type Attestation, type AttestationsFile, type Config, ConfigNotFoundError, ConfigValidationError, type CreateSealOptions, type VerifyOptions$1 as CryptoVerifyOptions, type KeyPair as Ed25519KeyPair, FilesystemKeyProvider, type FilesystemKeyProviderOptions, type FingerprintConfig, type FingerprintOptions, type FingerprintResult, type GateConfig, type Identity, type KeyGenerationResult, type KeyPaths, type KeyProvider, type KeyProviderConfig, type KeyProviderFactory, KeyProviderRegistry, type KeyProviderSettings, type KeyRetrievalResult, type KeygenOptions, type KeygenProviderOptions, type LocalConfig, LocalConfigValidationError, type MacOSKeychain, MacOSKeychainKeyProvider, type MacOSKeychainKeyProviderOptions, type OnePasswordAccount, OnePasswordKeyProvider, type OnePasswordKeyProviderOptions, type OnePasswordVault, type PrivateKeyRef, type ReadSignedAttestationsOptions, type Seal, type SealVerificationResult, type SealsFile, type SignOptions, SignatureInvalidError, type SignatureVerificationResult, type SuiteConfig, type SuiteVerificationResult, type TeamMember, type VerificationState, type VerificationStatus, type VerifyOptions, type VerifyResult, type WriteSignedAttestationsOptions, canonicalizeAttestations, checkOpenSSL, computeFingerprint, computeFingerprintSync, createAttestation, createSeal, findAttestation, findConfigPath, findTeamMemberByPublicKey, generateKeyPair as generateEd25519KeyPair, generateKeyPair$1 as generateKeyPair, getActiveIdentity, getAttestItConfigDir, getAttestItHomeDir, getAuthorizedSignersForGate, getDefaultPrivateKeyPath, getDefaultPublicKeyPath, getGate, getLocalConfigPath, getPublicKeyFromPrivate, isAuthorizedSigner, listPackageFiles, loadConfig, loadConfigSync, loadLocalConfig, loadLocalConfigSync, parseDuration, readAndVerifyAttestations, readAttestations, readAttestationsSync, readSeals, readSealsSync, removeAttestation, resolveConfigPaths, saveLocalConfig, saveLocalConfigSync, setAttestItHomeDir, setKeyPermissions, sign$1 as sign, sign as signEd25519, toAttestItConfig, upsertAttestation, verify$1 as verify, verifyAllSeals, verifyAttestations, verify as verifyEd25519, verifyGateSeal, verifySeal, version, writeAttestations, writeAttestationsSync, writeSeals, writeSealsSync, writeSignedAttestations };
package/dist/index.d.ts CHANGED
@@ -1384,6 +1384,18 @@ declare class OnePasswordKeyProvider implements KeyProvider {
1384
1384
  interface MacOSKeychainKeyProviderOptions {
1385
1385
  /** Item name in keychain (e.g., "attest-it-private-key") */
1386
1386
  itemName: string;
1387
+ /** Path to the keychain file (optional, uses default keychain if not specified) */
1388
+ keychain?: string;
1389
+ }
1390
+ /**
1391
+ * Information about a macOS keychain.
1392
+ * @public
1393
+ */
1394
+ interface MacOSKeychain {
1395
+ /** Full path to the keychain file */
1396
+ path: string;
1397
+ /** Display name (filename without extension) */
1398
+ name: string;
1387
1399
  }
1388
1400
  /**
1389
1401
  * Key provider that stores private keys in macOS Keychain.
@@ -1399,6 +1411,7 @@ declare class MacOSKeychainKeyProvider implements KeyProvider {
1399
1411
  readonly type = "macos-keychain";
1400
1412
  readonly displayName = "macOS Keychain";
1401
1413
  private readonly itemName;
1414
+ private readonly keychain?;
1402
1415
  private static readonly ACCOUNT;
1403
1416
  /**
1404
1417
  * Create a new MacOSKeychainKeyProvider.
@@ -1410,6 +1423,11 @@ declare class MacOSKeychainKeyProvider implements KeyProvider {
1410
1423
  * Only available on macOS platforms.
1411
1424
  */
1412
1425
  static isAvailable(): boolean;
1426
+ /**
1427
+ * List available keychains on the system.
1428
+ * @returns Array of keychain information
1429
+ */
1430
+ static listKeychains(): Promise<MacOSKeychain[]>;
1413
1431
  /**
1414
1432
  * Check if this provider is available on the current system.
1415
1433
  */
@@ -1495,6 +1513,7 @@ declare class KeyProviderRegistry {
1495
1513
  */
1496
1514
  type PrivateKeyRef = {
1497
1515
  account: string;
1516
+ keychain?: string;
1498
1517
  service: string;
1499
1518
  type: 'keychain';
1500
1519
  } | {
@@ -1539,6 +1558,21 @@ interface LocalConfig {
1539
1558
  * @packageDocumentation
1540
1559
  */
1541
1560
 
1561
+ /**
1562
+ * Set a custom home directory for attest-it configuration.
1563
+ * This is useful for testing or running with isolated state.
1564
+ *
1565
+ * @param dir - The directory to use, or null to reset to default
1566
+ * @public
1567
+ */
1568
+ declare function setAttestItHomeDir(dir: null | string): void;
1569
+ /**
1570
+ * Get the current attest-it home directory override.
1571
+ *
1572
+ * @returns The override directory, or null if using default
1573
+ * @public
1574
+ */
1575
+ declare function getAttestItHomeDir(): null | string;
1542
1576
  /**
1543
1577
  * Error thrown when local config validation fails.
1544
1578
  * @public
@@ -1550,10 +1584,23 @@ declare class LocalConfigValidationError extends Error {
1550
1584
  /**
1551
1585
  * Get the path to the local config file.
1552
1586
  *
1553
- * @returns Path to ~/.config/attest-it/config.yaml
1587
+ * If a home directory override is set via setAttestItHomeDir(),
1588
+ * returns {homeDir}/config.yaml. Otherwise returns ~/.config/attest-it/config.yaml.
1589
+ *
1590
+ * @returns Path to the local config file
1554
1591
  * @public
1555
1592
  */
1556
1593
  declare function getLocalConfigPath(): string;
1594
+ /**
1595
+ * Get the attest-it configuration directory.
1596
+ *
1597
+ * If a home directory override is set via setAttestItHomeDir(),
1598
+ * returns that directory. Otherwise returns ~/.config/attest-it.
1599
+ *
1600
+ * @returns Path to the configuration directory
1601
+ * @public
1602
+ */
1603
+ declare function getAttestItConfigDir(): string;
1557
1604
  /**
1558
1605
  * Load and validate local config from file (async).
1559
1606
  *
@@ -1826,4 +1873,4 @@ declare function verifyAllSeals(config: AttestItConfig, seals: SealsFile, finger
1826
1873
  */
1827
1874
  declare const version = "0.0.0";
1828
1875
 
1829
- export { type AttestItConfig, type AttestItSettings, type Attestation, type AttestationsFile, type Config, ConfigNotFoundError, ConfigValidationError, type CreateSealOptions, type VerifyOptions$1 as CryptoVerifyOptions, type KeyPair as Ed25519KeyPair, FilesystemKeyProvider, type FilesystemKeyProviderOptions, type FingerprintConfig, type FingerprintOptions, type FingerprintResult, type GateConfig, type Identity, type KeyGenerationResult, type KeyPaths, type KeyProvider, type KeyProviderConfig, type KeyProviderFactory, KeyProviderRegistry, type KeyProviderSettings, type KeyRetrievalResult, type KeygenOptions, type KeygenProviderOptions, type LocalConfig, LocalConfigValidationError, MacOSKeychainKeyProvider, type MacOSKeychainKeyProviderOptions, type OnePasswordAccount, OnePasswordKeyProvider, type OnePasswordKeyProviderOptions, type OnePasswordVault, type PrivateKeyRef, type ReadSignedAttestationsOptions, type Seal, type SealVerificationResult, type SealsFile, type SignOptions, SignatureInvalidError, type SignatureVerificationResult, type SuiteConfig, type SuiteVerificationResult, type TeamMember, type VerificationState, type VerificationStatus, type VerifyOptions, type VerifyResult, type WriteSignedAttestationsOptions, canonicalizeAttestations, checkOpenSSL, computeFingerprint, computeFingerprintSync, createAttestation, createSeal, findAttestation, findConfigPath, findTeamMemberByPublicKey, generateKeyPair as generateEd25519KeyPair, generateKeyPair$1 as generateKeyPair, getActiveIdentity, getAuthorizedSignersForGate, getDefaultPrivateKeyPath, getDefaultPublicKeyPath, getGate, getLocalConfigPath, getPublicKeyFromPrivate, isAuthorizedSigner, listPackageFiles, loadConfig, loadConfigSync, loadLocalConfig, loadLocalConfigSync, parseDuration, readAndVerifyAttestations, readAttestations, readAttestationsSync, readSeals, readSealsSync, removeAttestation, resolveConfigPaths, saveLocalConfig, saveLocalConfigSync, setKeyPermissions, sign$1 as sign, sign as signEd25519, toAttestItConfig, upsertAttestation, verify$1 as verify, verifyAllSeals, verifyAttestations, verify as verifyEd25519, verifyGateSeal, verifySeal, version, writeAttestations, writeAttestationsSync, writeSeals, writeSealsSync, writeSignedAttestations };
1876
+ export { type AttestItConfig, type AttestItSettings, type Attestation, type AttestationsFile, type Config, ConfigNotFoundError, ConfigValidationError, type CreateSealOptions, type VerifyOptions$1 as CryptoVerifyOptions, type KeyPair as Ed25519KeyPair, FilesystemKeyProvider, type FilesystemKeyProviderOptions, type FingerprintConfig, type FingerprintOptions, type FingerprintResult, type GateConfig, type Identity, type KeyGenerationResult, type KeyPaths, type KeyProvider, type KeyProviderConfig, type KeyProviderFactory, KeyProviderRegistry, type KeyProviderSettings, type KeyRetrievalResult, type KeygenOptions, type KeygenProviderOptions, type LocalConfig, LocalConfigValidationError, type MacOSKeychain, MacOSKeychainKeyProvider, type MacOSKeychainKeyProviderOptions, type OnePasswordAccount, OnePasswordKeyProvider, type OnePasswordKeyProviderOptions, type OnePasswordVault, type PrivateKeyRef, type ReadSignedAttestationsOptions, type Seal, type SealVerificationResult, type SealsFile, type SignOptions, SignatureInvalidError, type SignatureVerificationResult, type SuiteConfig, type SuiteVerificationResult, type TeamMember, type VerificationState, type VerificationStatus, type VerifyOptions, type VerifyResult, type WriteSignedAttestationsOptions, canonicalizeAttestations, checkOpenSSL, computeFingerprint, computeFingerprintSync, createAttestation, createSeal, findAttestation, findConfigPath, findTeamMemberByPublicKey, generateKeyPair as generateEd25519KeyPair, generateKeyPair$1 as generateKeyPair, getActiveIdentity, getAttestItConfigDir, getAttestItHomeDir, getAuthorizedSignersForGate, getDefaultPrivateKeyPath, getDefaultPublicKeyPath, getGate, getLocalConfigPath, getPublicKeyFromPrivate, isAuthorizedSigner, listPackageFiles, loadConfig, loadConfigSync, loadLocalConfig, loadLocalConfigSync, parseDuration, readAndVerifyAttestations, readAttestations, readAttestationsSync, readSeals, readSealsSync, removeAttestation, resolveConfigPaths, saveLocalConfig, saveLocalConfigSync, setAttestItHomeDir, setKeyPermissions, sign$1 as sign, sign as signEd25519, toAttestItConfig, upsertAttestation, verify$1 as verify, verifyAllSeals, verifyAttestations, verify as verifyEd25519, verifyGateSeal, verifySeal, version, writeAttestations, writeAttestationsSync, writeSeals, writeSealsSync, writeSignedAttestations };
package/dist/index.js CHANGED
@@ -1147,6 +1147,7 @@ var MacOSKeychainKeyProvider = class _MacOSKeychainKeyProvider {
1147
1147
  type = "macos-keychain";
1148
1148
  displayName = "macOS Keychain";
1149
1149
  itemName;
1150
+ keychain;
1150
1151
  static ACCOUNT = "attest-it";
1151
1152
  /**
1152
1153
  * Create a new MacOSKeychainKeyProvider.
@@ -1154,6 +1155,9 @@ var MacOSKeychainKeyProvider = class _MacOSKeychainKeyProvider {
1154
1155
  */
1155
1156
  constructor(options) {
1156
1157
  this.itemName = options.itemName;
1158
+ if (options.keychain !== void 0) {
1159
+ this.keychain = options.keychain;
1160
+ }
1157
1161
  }
1158
1162
  /**
1159
1163
  * Check if this provider is available.
@@ -1162,6 +1166,32 @@ var MacOSKeychainKeyProvider = class _MacOSKeychainKeyProvider {
1162
1166
  static isAvailable() {
1163
1167
  return process.platform === "darwin";
1164
1168
  }
1169
+ /**
1170
+ * List available keychains on the system.
1171
+ * @returns Array of keychain information
1172
+ */
1173
+ static async listKeychains() {
1174
+ if (!_MacOSKeychainKeyProvider.isAvailable()) {
1175
+ return [];
1176
+ }
1177
+ try {
1178
+ const output = await execCommand2("security", ["list-keychains"]);
1179
+ const keychains = [];
1180
+ const lines = output.split("\n");
1181
+ for (const line of lines) {
1182
+ const match = /"(.+)"/.exec(line.trim());
1183
+ if (match?.[1]) {
1184
+ const fullPath = match[1];
1185
+ const filename = fullPath.split("/").pop() ?? fullPath;
1186
+ const name = filename.replace(/\.keychain(-db)?$/, "");
1187
+ keychains.push({ path: fullPath, name });
1188
+ }
1189
+ }
1190
+ return keychains;
1191
+ } catch {
1192
+ return [];
1193
+ }
1194
+ }
1165
1195
  /**
1166
1196
  * Check if this provider is available on the current system.
1167
1197
  */
@@ -1174,13 +1204,11 @@ var MacOSKeychainKeyProvider = class _MacOSKeychainKeyProvider {
1174
1204
  */
1175
1205
  async keyExists(keyRef) {
1176
1206
  try {
1177
- await execCommand2("security", [
1178
- "find-generic-password",
1179
- "-a",
1180
- _MacOSKeychainKeyProvider.ACCOUNT,
1181
- "-s",
1182
- keyRef
1183
- ]);
1207
+ const args = ["find-generic-password", "-a", _MacOSKeychainKeyProvider.ACCOUNT, "-s", keyRef];
1208
+ if (this.keychain) {
1209
+ args.push(this.keychain);
1210
+ }
1211
+ await execCommand2("security", args);
1184
1212
  return true;
1185
1213
  } catch {
1186
1214
  return false;
@@ -1201,14 +1229,18 @@ var MacOSKeychainKeyProvider = class _MacOSKeychainKeyProvider {
1201
1229
  const tempDir = await fs6.mkdtemp(path6.join(os2.tmpdir(), "attest-it-"));
1202
1230
  const tempKeyPath = path6.join(tempDir, "private.pem");
1203
1231
  try {
1204
- const base64Key = await execCommand2("security", [
1232
+ const findArgs = [
1205
1233
  "find-generic-password",
1206
1234
  "-a",
1207
1235
  _MacOSKeychainKeyProvider.ACCOUNT,
1208
1236
  "-s",
1209
1237
  keyRef,
1210
1238
  "-w"
1211
- ]);
1239
+ ];
1240
+ if (this.keychain) {
1241
+ findArgs.push(this.keychain);
1242
+ }
1243
+ const base64Key = await execCommand2("security", findArgs);
1212
1244
  const keyContent = Buffer.from(base64Key, "base64").toString("utf8");
1213
1245
  await fs6.writeFile(tempKeyPath, keyContent, { mode: 384 });
1214
1246
  await setKeyPermissions(tempKeyPath);
@@ -1253,7 +1285,7 @@ var MacOSKeychainKeyProvider = class _MacOSKeychainKeyProvider {
1253
1285
  });
1254
1286
  const privateKeyContent = await fs6.readFile(tempPrivateKeyPath, "utf8");
1255
1287
  const base64Key = Buffer.from(privateKeyContent, "utf8").toString("base64");
1256
- await execCommand2("security", [
1288
+ const addArgs = [
1257
1289
  "add-generic-password",
1258
1290
  "-a",
1259
1291
  _MacOSKeychainKeyProvider.ACCOUNT,
@@ -1264,7 +1296,11 @@ var MacOSKeychainKeyProvider = class _MacOSKeychainKeyProvider {
1264
1296
  "-T",
1265
1297
  "",
1266
1298
  "-U"
1267
- ]);
1299
+ ];
1300
+ if (this.keychain) {
1301
+ addArgs.push(this.keychain);
1302
+ }
1303
+ await execCommand2("security", addArgs);
1268
1304
  await fs6.unlink(tempPrivateKeyPath);
1269
1305
  await fs6.rmdir(tempDir);
1270
1306
  return {
@@ -1381,6 +1417,13 @@ KeyProviderRegistry.register("macos-keychain", (config) => {
1381
1417
  }
1382
1418
  return new MacOSKeychainKeyProvider({ itemName });
1383
1419
  });
1420
+ var homeDirOverride = null;
1421
+ function setAttestItHomeDir(dir) {
1422
+ homeDirOverride = dir;
1423
+ }
1424
+ function getAttestItHomeDir() {
1425
+ return homeDirOverride;
1426
+ }
1384
1427
  var privateKeyRefSchema = z.discriminatedUnion("type", [
1385
1428
  z.object({
1386
1429
  type: z.literal("file"),
@@ -1389,7 +1432,8 @@ var privateKeyRefSchema = z.discriminatedUnion("type", [
1389
1432
  z.object({
1390
1433
  type: z.literal("keychain"),
1391
1434
  service: z.string().min(1, "Service name cannot be empty"),
1392
- account: z.string().min(1, "Account name cannot be empty")
1435
+ account: z.string().min(1, "Account name cannot be empty"),
1436
+ keychain: z.string().optional()
1393
1437
  }),
1394
1438
  z.object({
1395
1439
  type: z.literal("1password"),
@@ -1420,9 +1464,18 @@ var LocalConfigValidationError = class extends Error {
1420
1464
  }
1421
1465
  };
1422
1466
  function getLocalConfigPath() {
1467
+ if (homeDirOverride) {
1468
+ return join(homeDirOverride, "config.yaml");
1469
+ }
1423
1470
  const home = homedir();
1424
1471
  return join(home, ".config", "attest-it", "config.yaml");
1425
1472
  }
1473
+ function getAttestItConfigDir() {
1474
+ if (homeDirOverride) {
1475
+ return homeDirOverride;
1476
+ }
1477
+ return join(homedir(), ".config", "attest-it");
1478
+ }
1426
1479
  function parseLocalConfigContent(content) {
1427
1480
  let rawConfig;
1428
1481
  try {
@@ -1453,6 +1506,15 @@ function parseLocalConfigContent(content) {
1453
1506
  },
1454
1507
  ...identity.privateKey.field !== void 0 && { field: identity.privateKey.field }
1455
1508
  };
1509
+ } else if (identity.privateKey.type === "keychain") {
1510
+ privateKey = {
1511
+ type: "keychain",
1512
+ service: identity.privateKey.service,
1513
+ account: identity.privateKey.account,
1514
+ ...identity.privateKey.keychain !== void 0 && {
1515
+ keychain: identity.privateKey.keychain
1516
+ }
1517
+ };
1456
1518
  } else {
1457
1519
  privateKey = identity.privateKey;
1458
1520
  }
@@ -1836,6 +1898,6 @@ function verifyAllSeals(config, seals, fingerprints) {
1836
1898
  // src/index.ts
1837
1899
  var version = "0.0.0";
1838
1900
 
1839
- export { ConfigNotFoundError, ConfigValidationError, FilesystemKeyProvider, KeyProviderRegistry, LocalConfigValidationError, MacOSKeychainKeyProvider, OnePasswordKeyProvider, SignatureInvalidError, canonicalizeAttestations, computeFingerprint, computeFingerprintSync, createAttestation, createSeal, findAttestation, findConfigPath, findTeamMemberByPublicKey, generateKeyPair2 as generateEd25519KeyPair, getActiveIdentity, getAuthorizedSignersForGate, getGate, getLocalConfigPath, getPublicKeyFromPrivate, isAuthorizedSigner, listPackageFiles, loadConfig, loadConfigSync, loadLocalConfig, loadLocalConfigSync, parseDuration, readAndVerifyAttestations, readAttestations, readAttestationsSync, readSeals, readSealsSync, removeAttestation, resolveConfigPaths, saveLocalConfig, saveLocalConfigSync, sign3 as signEd25519, toAttestItConfig, upsertAttestation, verifyAllSeals, verifyAttestations, verify3 as verifyEd25519, verifyGateSeal, verifySeal, version, writeAttestations, writeAttestationsSync, writeSeals, writeSealsSync, writeSignedAttestations };
1901
+ export { ConfigNotFoundError, ConfigValidationError, FilesystemKeyProvider, KeyProviderRegistry, LocalConfigValidationError, MacOSKeychainKeyProvider, OnePasswordKeyProvider, SignatureInvalidError, canonicalizeAttestations, computeFingerprint, computeFingerprintSync, createAttestation, createSeal, findAttestation, findConfigPath, findTeamMemberByPublicKey, generateKeyPair2 as generateEd25519KeyPair, getActiveIdentity, getAttestItConfigDir, getAttestItHomeDir, getAuthorizedSignersForGate, getGate, getLocalConfigPath, getPublicKeyFromPrivate, isAuthorizedSigner, listPackageFiles, loadConfig, loadConfigSync, loadLocalConfig, loadLocalConfigSync, parseDuration, readAndVerifyAttestations, readAttestations, readAttestationsSync, readSeals, readSealsSync, removeAttestation, resolveConfigPaths, saveLocalConfig, saveLocalConfigSync, setAttestItHomeDir, sign3 as signEd25519, toAttestItConfig, upsertAttestation, verifyAllSeals, verifyAttestations, verify3 as verifyEd25519, verifyGateSeal, verifySeal, version, writeAttestations, writeAttestationsSync, writeSeals, writeSealsSync, writeSignedAttestations };
1840
1902
  //# sourceMappingURL=index.js.map
1841
1903
  //# sourceMappingURL=index.js.map